linux-kernel - Re: [PATCH] MODSIGN: Add TAINT_NOKEY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 16 Jan 2013 08:21:27 -0500
From:	Josh Boyer <jwboyer@...hat.com>
To:	Rusty Russell <rusty@...tcorp.com.au>
Cc:	"Frank Ch. Eigler" <fche@...hat.com>, dhowells@...hat.com,
	linux-kernel@...r.kernel.org, peterz@...radead.org,
	mingo@...hat.com
Subject: Re: [PATCH] MODSIGN: Add TAINT_NOKEY_MODULE

On Wed, Jan 16, 2013 at 02:04:50PM +1030, Rusty Russell wrote:
> Josh Boyer <jwboyer@...hat.com> writes:
> > With module signing enabled but not in enforcing mode, we don't consider
> > unsigned modules to be an error.  However, if we encounter an unsigned
> > module we currently taint the module and kernel with TAINT_FORCED_MODULE.
> > That also disables lockdep within the kernel.
> 
> How about this, instead?  Ingo?

That would work for me for the lockdep issue, sure.  I thought I'd make
the unsigned/wrong key module case a bit more clear at the same time.
Do you think that's worth doing aside from lockdep?  If so, and your
patch seems acceptable to others, I'd be happy to respin my patch on
top.

I'll give your patch a test in just a bit.

josh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/